crypto.Error: verification failed, OpenSSL error (seen in agent logs after you upgrade the MsgBus Cert to version 5.7.7.435)

Technical Articles ID: KB96142
Last Modified: 2022-11-21 12:28:28 Etc/GMT

Environment

Trellix Agent (TA) 5.x

Problem

After you upgrade the MsgBus Cert Updater package to version 5.7.7.435 on TA, the AMCore updates aren't applied.
You see messages similar to the following in the masvc<computername>.log file:

masvc(5856.6828) msgbus.Info: Adding <C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe>:<4728> auth info reference
masvc(5856.6828) msgbus.Info: executable <C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe> is trusted via authenticode. Signer: <McAfee, Inc.> Issuer: <GlobalSign CodeSigning CA - G3>
masvc(5856.6828) msgbus.Info: Allowing <4728> onto msgbus
masvc(5856.6828) compatservice.Info: Received notifications for changes on backcompat watcher
masvc(5856.6828) compatservice.Info: is_compat_running: 1, is_compat_required: 1
masvc(5856.6828) Repository.Error: detect system proxy failed <rc = 12>.
masvc(5856.6828) msgbus.Info: QueryFullProcessImageName C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe
masvc(5856.6828) crypto.Error: verification failed, openssl error 554127477 <error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error>
masvc(5856.6828) crypto.Error: verification failed due to 1.
masvc(5856.6828) msgbus.Error: cms verify failed for sig fd 10, rc 1201
masvc(5856.6828) msgbus.Error: cms verify failed for sig fd 10, rc 1201
masvc(5856.6828) msgbus.Warning: Allowing <C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe(5496)> limited access onto msgbus

The McScript.log file lists the following errors and information:

#4856 ScrptExe Running "C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe"
/LPCPUID=AMCORE__2000:4728_1674873089:0001

#4856 ScrptExe Executing "C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe"
/LPCPUID=AMCORE__2000:4728_1674873089:0001 /INITEVENT=NOTIFY_INIT_{65D6FFF1-FBF3-4382-BCAA-A129912124E9} /DEINITEVENT=NOTIFY_DEINIT_{0ED7F3E2-7C00-49E6-A3A4-C31FC4F148B2}

#4856 UpdatePlugin Error trace:

#4856 Thread [Main thread]->

#4856 SessMgr [SessionManager::runScript:C:\ProgramData\McAfee\Agent\update\UpdateMain.McS]->

#4856 UpdatePlugin LPCException occurred in MfeUpdatePluginWrapper::setProductInfo()

#4856 ScrptExe Failed to set the product information. Setting SetMcShieldClientdll to FALSE

#4856 ScrptExe Could not deinitialize the process with id - AMCORE__2000:4728_1674873089:0001 as no such process exists

#4856 ScrptExe Executing section: [LatestAlreadyInstalled]

#4856 ScrptMgr Product(s) running the latest AMCore.

#4856 ScrptExe Script executed. Setting dwRet to 0

Cause

The following location doesn't contain the updated MsgBus Cert Updater files:

C:\ProgramData\McAfee\Agent\certstore

The MsgBus Cert Updater must contain the following 22 certificates:

mcafee_inc_2025.cer
mfeca.cer
mfeca_2014_2017.cer
mfeca_iam_2020.cer
mfeca_inc_sha1_2019_2022.cer
mfeca_inc_sha256_2019_2022.cer
mfeca_llc_sha1_2019_2022.cer
mfeca_llc_sha256_2019_2022.cer
mfeca_sha1_2016_2019.cer
mfeca_sha256_2016_2019.cer
mfe_GlobalSign_CodeSigning_ca_sha1.cer
mfe_GlobalSign_CodeSigning_ca_sha256.cer
mfe_GlobalSign_Root_ca_sha1.cer
mfe_GlobalSign_Root_ca_sha256.cer
mfe_sia_ca_root.pem.cer
mfe_sia_ca_signer.pem.cer
ml_cacerts.cer
musarubra.cer
trellix_Enterprise_GlobalSign_4_2022_2025_pem.cer
trellix_GlobalSign_CC_R45_CodeSigning_CA_pem.cer
trellix_GlobalSign_CodeSigning_Root_R45_pem.cer
trellix_Platform_GlobalSign_4_2022_2025_pem.cer

For more information about the TA MsgBus Cert Updater 5.7.7.435, see KB95958 - Trellix Agent MsgBus cert updater package 5.7.7.435 contains updated Musarubra and McAfee Inc Certificates.

Solution

This issue is resolved in Trellix MsgBusCertsUpdater.zip version 5.7.7.535, which is available from either the ePO Software Manager or the Product Downloads site.

NOTE: You need a valid Grant Number to access the update.

To view other known and resolved issues, see KB93773 - Trellix Agent 5.7.x Known Issues.

NOTE: If the task doesn't add all the needed certs to C:\ProgramData\McAfee\Agent\certstore, the update reports Fails and allows the task to be rerun on the next assignment.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

crypto.Error: verification failed, OpenSSL error (seen in agent logs after you upgrade the MsgBus Cert to version 5.7.7.435)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

crypto.Error: verification failed, OpenSSL error (seen in agent logs after you upgrade the MsgBus Cert to version 5.7.7.435)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title